Digital Forensics and OSINT

Two disciplines that sit at the intersection of security management and investigation are increasingly relevant to organisations of all sizes: digital forensics and Open Source Intelligence (OSINT). Neither is primarily a management skill; both are specialist disciplines requiring specific technical training. However, managers who understand what these disciplines involve, what they can and cannot achieve, and how they relate to broader security management are better equipped to support their organisation’s response to incidents and their security intelligence activities.

Digital Forensics

Digital forensics is the process of collecting, preserving, analysing and presenting digital evidence in a way that is rigorous enough to withstand legal scrutiny. It is used in the aftermath of security incidents to determine what happened, when it happened, how it happened, and who was responsible. The findings of a digital forensics investigation may be used to support criminal prosecutions, civil litigation, regulatory investigations or internal disciplinary proceedings, as well as to inform improvements to security controls and processes.

The key principle underlying digital forensics is the preservation of the integrity of evidence. Digital evidence is inherently fragile: it can be altered, deleted or contaminated by the actions of those investigating it if those actions are not conducted in accordance with accepted forensic procedures. The concept of the chain of custody describes the documented, unbroken sequence of possession, transfer and analysis of evidence from the point of collection to the point of presentation in legal or regulatory proceedings. Any break in the chain of custody may render evidence inadmissible or unreliable.

What Digital Forensics Involves in Practice

• Evidence acquisition: the collection of digital evidence in a forensically sound manner. This typically involves creating an exact, bit-for-bit copy of a storage device or memory state rather than working with the original, to ensure that the original evidence is not modified during investigation. Forensic acquisition may cover hard drives, mobile devices, cloud storage, email systems, network logs and security monitoring data.
• Evidence analysis: examining the acquired evidence to reconstruct the timeline of events, identify indicators of compromise, trace attacker activity through systems and networks, and recover deleted or hidden data. Analysis requires specialist tools and expertise.
• Reporting: presenting the findings of the investigation in a clear, accurate and well-documented format that is appropriate for its intended audience, whether that is a law enforcement agency, a regulatory body, a court, a board or an internal disciplinary hearing.

The Manager’s Role in Digital Forensics

When a security incident triggers a forensic investigation, managers have specific responsibilities that they must understand before an incident occurs:

• Do not interfere with potential evidence: one of the most common and damaging mistakes in the aftermath of a security incident is for well-intentioned individuals to attempt to investigate or clean up a compromised system before forensic investigators have had the opportunity to acquire evidence. Turning a compromised device off and on, deleting files, running cleanup tools or even simply continuing to use an affected system can destroy or contaminate forensic evidence irreparably. Managers must know that if a device is suspected to have been compromised, the correct action is to leave it as it is and contact the incident response team or security function immediately.
• Preserve logs and records: business records, email archives, access logs and other documentation may be relevant to a forensic investigation. Managers should ensure that routine data deletion or archiving processes are suspended for relevant systems when an investigation is underway.
• Cooperate fully and promptly: forensic investigations work best when all relevant parties cooperate transparently. Providing accurate, timely information about what you know, what systems your team uses and what activity may be relevant is a direct contribution to an effective investigation.

Open Source Intelligence (OSINT)

Open Source Intelligence (OSINT) refers to the process of collecting, analysing and interpreting information from publicly available and legally accessible sources in order to generate actionable intelligence. The term open source in this context means available to the public, not open source software: OSINT sources include social media platforms, websites, news articles, public databases, online forums, job postings, company filings and any other information that can be legally accessed without special authorisation.

In a cyber security context, OSINT is used for several purposes:

• Threat intelligence: understanding the tactics, techniques and procedures of known threat actors by analysing their public communications, malware samples shared in security research communities, and reports of their activities against other organisations. This intelligence helps organisations anticipate and prepare for attacks that may target them.
• Attack surface monitoring: identifying what information about an organisation is publicly available that could be used by an attacker to plan or conduct an attack. This includes identifying exposed systems and services, leaked credentials, publicly accessible internal documents, and information in job postings that reveals details of internal technology stacks.
• Incident response support: during and after a security incident, OSINT can help identify the malware variant used, the attacker’s infrastructure, indicators of compromise that can be used to detect further malicious activity, and patterns of behaviour consistent with known threat actor groups.
• Background and due diligence: OSINT techniques are used to research third parties, potential business partners or individuals of interest using publicly available information, contributing to supplier risk assessments and other due diligence activities.

OSINT and the Dual-Use Challenge

An important consideration for managers is that OSINT is a dual-use capability: the same techniques and tools that security professionals use to protect organisations are used by attackers to identify targets, understand their vulnerabilities and plan their attacks. An attacker conducting reconnaissance on an organisation before launching an attack will typically gather extensive OSINT: mapping the organisation’s online presence, identifying key personnel from LinkedIn, finding technology details from job postings, and searching data breach databases for previously compromised credentials belonging to employees of the target organisation.

This dual-use nature has practical implications. Information that your organisation makes publicly available, whether intentionally or inadvertently, may be used by an attacker. Managers who understand this think carefully about what information their team shares publicly: the technology tools they mention in job postings, the internal processes described in public-facing documents, the personal professional information their team members share on social media, and the data that may have been inadvertently exposed in previous incidents.